e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09.exe
Size

924KB
MD5

0d0e6a0085829ee09b7fce9efe1d0d48
SHA1

812bd5deadb1bf1cd00b81ab967a090f3d9c9162
SHA256

e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09
SHA512

c0feeb7da0ccb305953cf4e5734a7c4d92e9817c27b5a766df547dc1f313c8400fe941bf017edd84b6cc8ac4ab300648978a5c24b23bd6d4ea147172e13b3c89
SSDEEP

24576:h1OYdaOUfC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuX1:h1OsdMN6wdBh5N5Z4E8PuX1

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ryjvBYjucrId0mz.exe

pid process

5088 ryjvBYjucrId0mz.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

ryjvBYjucrId0mz.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbfikhhofbegklpifohcaofcggngbbaa\2.0\manifest.json	ryjvBYjucrId0mz.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbfikhhofbegklpifohcaofcggngbbaa\2.0\manifest.json	ryjvBYjucrId0mz.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbfikhhofbegklpifohcaofcggngbbaa\2.0\manifest.json	ryjvBYjucrId0mz.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbfikhhofbegklpifohcaofcggngbbaa\2.0\manifest.json	ryjvBYjucrId0mz.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbfikhhofbegklpifohcaofcggngbbaa\2.0\manifest.json	ryjvBYjucrId0mz.exe

Drops file in System32 directory 4 IoCs

Processes:

ryjvBYjucrId0mz.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	ryjvBYjucrId0mz.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ryjvBYjucrId0mz.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ryjvBYjucrId0mz.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ryjvBYjucrId0mz.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

ryjvBYjucrId0mz.exe

pid	process
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe
5088	ryjvBYjucrId0mz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ryjvBYjucrId0mz.exe

description	pid	process
Token: SeDebugPrivilege	5088	ryjvBYjucrId0mz.exe
Token: SeDebugPrivilege	5088	ryjvBYjucrId0mz.exe
Token: SeDebugPrivilege	5088	ryjvBYjucrId0mz.exe
Token: SeDebugPrivilege	5088	ryjvBYjucrId0mz.exe
Token: SeDebugPrivilege	5088	ryjvBYjucrId0mz.exe
Token: SeDebugPrivilege	5088	ryjvBYjucrId0mz.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09.exe

description	pid	process	target process
PID 1444 wrote to memory of 5088	1444	e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09.exe	ryjvBYjucrId0mz.exe
PID 1444 wrote to memory of 5088	1444	e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09.exe	ryjvBYjucrId0mz.exe
PID 1444 wrote to memory of 5088	1444	e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09.exe	ryjvBYjucrId0mz.exe

C:\Users\Admin\AppData\Local\Temp\e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09.exe
"C:\Users\Admin\AppData\Local\Temp\e93126bfdbb61ff34c64a283d581cb8ead85fe3ff838266ca189f598b0a92d09.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\ryjvBYjucrId0mz.exe
.\ryjvBYjucrId0mz.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
a5fe464b417efd195081fefcd65d6dc9

SHA1
06fb8c2045e2eaa468636b0434c046c2e5a633f5

SHA256
0187702930b17ec55eb848e018e0392832027fff2d30e83d62af0f9d112aa701

SHA512
4addd820d12f65b43eef4e02ec034841aa4fb2d5dbdd015167bfdbeedec3fc6653e8117e5b92f3b9de2cf84600c40de09ee1f660fcb65441550308e1aceb96d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
d92c686d4c23cdb45bf97e76f0e7e0ad

SHA1
e28f88c134f660973a88fcb4d2e882fec83de382

SHA256
d24ad0e9f46985618c1a0146126ae58461a1cf2914eaf72ccc2928d467df9f03

SHA512
10ded68a1de87091df043dcfc3cb107180bd65cdc197bdcd82b91f2f0d81bb1238e50dd699bb17a8edbd560ef5d05073d8f38cd5773ca81a21f00123b65eecb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\[email protected]\install.rdf
Filesize
598B

MD5
46a75cf02c8b931cbc615f45741444aa

SHA1
6516872857ac934bf1633e1de9cfef563107b25d

SHA256
64a8eab1a76e801608dc1a3d61cd27190cbacda4a95770faa48020e0f6852fe0

SHA512
500a6712083eb8e001f9e0bbe57a313d730557a5d9ea333be2c7fd5185cc94397c67bd9f263146259e4e9d6b423e586250af2844abcbdcdf21f6466fbbf99b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\pbfikhhofbegklpifohcaofcggngbbaa\H.js
Filesize
6KB

MD5
32363520ae995c1c9fa840441b06f5fc

SHA1
88fc5efa5c5c96381df6e609864f022806ec907f

SHA256
6acfc0525218cccb3b7a166c4461b2351084d25e98f56876a74e83160b4f43ac

SHA512
87a42f0bcae08f59cc51ad93a58530ccde4d94028d2f289a91aebe6fb689ce3aecd0528c4363b5faceb432b1e39ecebeea1a0cc2b96ad5b630cae82f1efe6290

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\pbfikhhofbegklpifohcaofcggngbbaa\background.html
Filesize
138B

MD5
6f78a9f8b3159b436ed441ca0fa88fb7

SHA1
78b91858aceb4c4b345970b7f5375bd9c5cee5e7

SHA256
df00d7c896f5836452fe07dd66a17dd46157fdec21d3c8ca886b1a7ba909165e

SHA512
f867296bae6366e6328c8bead204c16130aad48e3c8770a99bf994eb85e7d31c748ed6d219c5bbcc8b2619c0721396213dfe82e4c0072938f6135ca91d627d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\pbfikhhofbegklpifohcaofcggngbbaa\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\pbfikhhofbegklpifohcaofcggngbbaa\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\pbfikhhofbegklpifohcaofcggngbbaa\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\ryjvBYjucrId0mz.dat
Filesize
1KB

MD5
557e37bc84d37d292290770fce00afcf

SHA1
f637b145a2aa0a4cf053ecda0ef15cd7c33f0bc7

SHA256
b6befc0fe8f35d1f11fff3e67601acca672fa116fa792349be0e8e2b0a624047

SHA512
f2e0f8f74c3473f8bba7489d142c5bef81661e6fd51da37ce9759a69f19c554d11124aeaa35f5ca36789771c219d279e4bba744394bc1e7f3976271c2f8480ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\ryjvBYjucrId0mz.exe
Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3F5.tmp\ryjvBYjucrId0mz.exe
Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
memory/5088-132-0x0000000000000000-mapping.dmp

Download